Stored XSS in Three WordPress Chat Plugins
WP Live Chat Support, MyLiveChat and Provide Support all accepted stored cross-site scripting during a 2014 customer install.
Coordinated disclosure
Path Traversal on map.prezi.com ($1,000)
A path traversal issue on Prezi’s map.prezi.com subdomain, fixed within two days of reporting and rewarded with a $1,000 bounty.
160 German tax office sites vulnerable to XSS
Reflected cross-site scripting across 160 German tax office websites, disclosed via heise.de and forwarded to CERT-Bund for coordinated remediation.